CVE-2026-114395: Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a Trudesk user. The issue can be exploited remotely and does not require user interaction.
What access does exploitation provide?
An authenticated attacker can submit spoofed messages as other users and inject them into conversations that the attacker does not belong to. The reported impact is limited to integrity; no confidentiality or availability impact is specified.
What request fields are involved in the bypass?
The vulnerable endpoint is POST /api/v1/messages/send. Exploitation involves supplying arbitrary owner and cId values to apiMessages.send.
Which versions are affected?
The issue affects Trudesk through version 1.2.11. The provided information does not identify a fixed version.